Last updated: October 2026

1. WHO WE ARE

Joyal is a loyalty platform that enables local businesses to run digital loyalty programmes for their customers. Depending on your relationship with us, you may be a:

• Customer: a member of a business's loyalty programme
• Business Owner: a business that uses Joyal to manage their loyalty programme
• Staff Member: an employee or team member of a business on Joyal
• Affiliate: a referral partner of Joyal
• Person Booking: someone who books an appointment online with a business that has connected its booking system to Joyal, whether or not they have joined its loyalty programme

This policy applies to all of the above.

2. WHAT DATA WE COLLECT

Depending on how you use Joyal, we may collect the following personal data:

Account & Identity

• Full name
• Email address
• Phone number (optional)
  

Loyalty & Transaction Data

• Points balance and transaction history
• Rewards claimed and redeemed
• Member number assigned to you
• Visit history and activity timestamps

Business Data (Business Owners)

• Business name, logo, branding assets
• Billing and subscription information (handled via Stripe)
• Staff invitation records

Communications

• Email notification preferences
• Push notification preferences and tokens
• Unsubscribe records

Technical & Device Data

• IP address (used for rate limiting and security)
• User agent string (browser/device type)
• Authentication session tokens

Location Data (Staff & Owner Accounts)

• Approximate GPS position (latitude, longitude, and accuracy) of the staff device at the moment a scan, points adjustment, or reward redemption is processed
• The registered business location the transaction was matched to
• Location is captured only at the moment of these actions - staff devices are never tracked in the background.
• We never access the location of Customer devices; the location recorded against a Customer's transaction comes from the staff device that processed it.
  

Square Sales (only where a business connects its Square till).

• The amount of each purchase you were added to in Square (not including any tip), when it was paid, and Square's receipt number and location reference for it
• Square's notice of a sale can include details of how it was paid; we do not keep them, and we keep nothing about sales you were not added to
• For Business Owners who connect Square: the name of the connected Square account, and the access Square grants Joyal, which we store encrypted
  

Online Bookings (only where a business connects its online booking system, such as Acuity Scheduling)

• The business's booking system sends Joyal a copy of the confirmation email for each booking, change and cancellation made with that business. It includes the name, email address and phone number of the person booking, what they booked, when, and the amount paid
• For bookings made through a business's Joyal app, we keep the time and length of the appointment, the amount paid, the points it earns, the email address used to book, any certificate or discount code used, and the booking system's reference for it
• For bookings not made through a Joyal app, we keep no personal details. If we cannot read a booking email, we keep its subject line, which can include the name of the person booking, so we can put the problem right
• When you tap Book in a business's Joyal app, we fill in your name and email address on the business's booking page for you, together with a one-off booking code that links the booking to your account

We do not collect payment card details directly. All payment processing is handled securely by Stripe.


3. HOW WE USE YOUR DATA

a) To provide the service (Lawful basis: Contract)

• Create and manage your account
• Track and display your loyalty points and transaction history
• Process reward claims and redemptions
• Allow staff to look up and manage customer accounts

b) To communicate with you about your account (Lawful basis: Contract / Legitimate Interest)

• Send transactional emails (e.g. password reset, account signup confirmation, points awarded)
• Send push notifications relating to your loyalty account activity (new rewards, reminders)

c) To send updates and news from a business you are a member of (Lawful basis: Consent)

• If you opted in at signup, we may send you announcements, promotions, or news from the specific business whose loyalty programme you joined
• You can withdraw this consent at any time by clicking the unsubscribe link in any such email or updating your preferences in your account

d) To operate and improve the platform (Lawful basis: Legitimate Interest)

• Monitor platform performance and diagnose errors (via Sentry, server-side only)
• Enforce rate limits and prevent abuse
• Maintain audit logs of staff actions for security and accountability

e) To process payments (Lawful basis: Contract)

• Business owner billing is handled by Stripe; we pass your billing details to Stripe for this purpose

f) To verify where transactions take place (Lawful basis: Legitimate Interest)

• Attribute points and reward transactions to the business location where they occurred
• Detect fraudulent, off-site, or otherwise suspicious transaction activity
• Staff Members may decline the location permission on their device at any time; transactions will still complete and will simply be recorded without location information.
  

g) To understand how our website is used (Lawful basis: Consent):

• We use PostHog, an analytics tool, on our public marketing website at joyal.co to count page visits and see which pages people find useful
• This is used only on our marketing pages. There is no analytics tracking inside the loyalty app itself: no analytics runs on your business's loyalty pages, your points balance, or your account
• We do not record your screen, we do not use analytics for advertising, and we never link website analytics to your loyalty account
• You can decline analytics cookies using the banner shown on your first visit. See section 7 for details

h) To operate, support and secure the platform (Lawful basis: Legitimate Interest):

• A small number of named Joyal administrator accounts can access business and customer records through an internal admin dashboard. This is used to run the service: providing support to businesses, investigating faults and billing questions, monitoring platform health, and detecting fraud or abuse
• The information visible to a Joyal administrator includes business account details and, for customers of that business, name, email address, member number, points balance and visit activity
• Access is limited to what is needed to do the job. We do not use this access to market to you, and we never sell or share this data. Where we are acting as a data processor on behalf of a business (see our Terms of Service, section 5.3), we access this data only to provide and support the platform
  

i) To add your points automatically when a business uses Square (Lawful basis: Contract)

• If a business whose loyalty programme you have joined, or where you are a Staff Member, uses Square at its till and connects it to Joyal, we copy your name, email address and member number, together with your Joyal code, into that business's customer list in Square, so staff can find you by scanning your Joyal code at the till. If the business already has you as a customer in Square under the same email address, we add your member number and Joyal code to that existing record instead of making a second one
• If we made the copy, we keep it up to date when your details change in Joyal
• When a sale is paid at that business, Square tells us. Where you were added to the sale, we use the amount paid to add your points automatically
• Because your email address is on the business's Square record, Square may email you a receipt for those purchases
• Joyal does not sign you up to the business's marketing in Square, and our Terms of Service do not allow the business to send you marketing through Square unless you have agreed to receive it
  

j) To add your points automatically when you book online (Lawful basis: Contract)

• If a business whose loyalty programme you have joined connects its online booking system to Joyal, and you book through its Joyal app, we use the booking to add your points automatically once your appointment has taken place, worked out from the amount paid. A booking that is cancelled before then earns nothing
• The business's booking system sends us a copy of every booking it receives, because that is how it reports them. We use only what is needed to recognise the bookings made through a Joyal app, and keep nothing personal from the rest
• When we handle booking details for a business, including for people who are not members of its programme, we act as that business's data processor and only on its instructions (see our Terms of Service, section 5.3). For people who are not members, the business is responsible for its own booking records, and its own privacy notice applies

4. HOW LONG WE KEEP YOUR DATA

We keep your personal data only for as long as necessary for the purposes described above:

• Active accounts: data is retained for as long as your account remains active
• Inactive customer accounts: we aim to review and delete accounts with no activity after 3 years
• Transaction history: retained for up to 7 years to meet financial record-keeping obligations
• Location data: stored as part of transaction records and retained on the same basis as transaction history
• Square sales: the purchases that earned you points are kept as part of your transaction history, on the same basis
• Your record in a business's Square account: when you leave that business's programme or delete your account, we delete the copy we made, usually within minutes and at the latest within a day. If we added our details to the business's own customer record in Square, we remove the member number and Joyal code we added, and the business's own record stays under its control. If the business disconnects Square, we do the same for all of its members. If the business removes Joyal's access from inside Square instead, we can no longer reach those records, and they become the business's responsibility
• Online bookings: bookings that earned you points are kept as part of your transaction history, on the same basis. Booking records that earned nothing, and our log of the booking emails we received, are deleted 90 days after the appointment or the email
• Booking codes: deleted about a month after they are made
• Booking emails: our email provider keeps the full copy of each booking email it receives for us for up to 30 days, then deletes it
• Audit logs: retained for 2 years
• Website analytics: retained for up to 12 months
• Deleted accounts: when you delete your account, your personal details (name, email, phone) are removed; anonymised transaction records (with no link back to you) may be retained to preserve business reporting integrity

5. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data.

Access within Joyal: Your data can be accessed by a small number of named Joyal administrator accounts for the purposes described in section 3(h): running, supporting and securing the platform. This access is restricted to those accounts and is not available to other staff or to other businesses on the platform.

Sub-processors: We use the following trusted third-party service providers ("sub-processors") who may process your data on our behalf:

• Supabase (Supabase Inc.) - database and authentication infrastructure
• Vercel (Vercel Inc.) - hosting and serverless infrastructure
• Resend (Resend Inc.) - transactional and notification email delivery, and receiving the booking emails a business's booking system sends to Joyal
• Stripe (Stripe Inc.) - payment processing for business owner subscriptions
• PostHog (PostHog Inc.) - website analytics for our public marketing pages, hosted in the European Union
• Sentry (Functional Software Inc.) - server-side error monitoring, so we can diagnose faults
  

All sub-processors are contractually bound to process your data only as instructed and in accordance with GDPR.

A business's own connected tools: if a business you belong to connects its own Square account, the record described in section 3(i) is held by Square for that business, under the business's own agreement with Square. Square is the business's own point-of-sale and payments provider, chosen by the business, not a sub-processor of ours.

A business's online booking system: if a business you book with connects its online booking system, such as Acuity Scheduling, to Joyal, that system sends us the booking emails described in section 2. The booking system is the business's own provider, chosen by the business, not a sub-processor of ours, and it holds your booking under the business's own agreement with it. When you tap Book in a Joyal app, your name, email address and booking code are passed to that booking page so you do not have to type them.

We may also disclose your data if required to do so by law, regulation, or a valid court order.

6. DATA SECURITY

We implement industry-standard technical and organisational measures to protect your personal data, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Supabase row-level security (RLS) policies restricting data access to authorised users only
• Authentication tokens stored securely with automatic expiry
• Rate limiting on all sensitive API endpoints
• Access to a business's Square account stored encrypted, and every message from Square checked for Square's signature before it is used
• Booking emails accepted only when they are signed by the booking system itself, so an email made to look like a booking cannot add points
• Server-side error monitoring without personal data exposure

No system is completely secure, and we cannot guarantee absolute security. If you become aware of any suspected breach, please contact info@joyal.co immediately.

7. COOKIES

We use a small number of cookies. We do not use advertising cookies and we do not sell or share any cookie data.

Session Cookie (Strictly Necessary)

• Name: sb-[project-ref]-auth-token (set by Supabase Auth)
• Purpose: Keeps you securely logged in while you use the platform. This cookie contains an encrypted authentication token and is required for the service to function.
• Duration: Expires when you log out or after a period of inactivity (typically 1 hour for session tokens, up to 1 week with refresh).
• Third-party: No, set by Joyal's own infrastructure via Supabase.
• Because this cookie is strictly necessary, we are not required to obtain your consent before setting it under the EU ePrivacy Directive.

Analytics Cookie (Optional)

• Set by: PostHog, hosted in the European Union
• Where: our public marketing website at joyal.co only. This cookie is never set inside the loyalty app, so it does not run on your business's loyalty pages, your points balance, or your account.
• Purpose: counts page visits and recognises a returning browser, so we can see which pages are useful and improve the site.
• Duration: up to 12 months.
• Your choice: a banner appears on your first visit to the website. If you choose "No thanks", PostHog switches to a cookie-free mode: your visit is still counted as an anonymous page view, but no cookie is kept on your device and no identifier is stored. Until you make a choice, the cookie may already be set from your first page view. You can clear it at any time by clearing your browser's cookies.
• We do not use PostHog session recording, heatmaps, or surveys, and we do not link website analytics to your loyalty account.

We do not use Google Analytics, Facebook Pixel, or any advertising or ad-retargeting cookies.

8. YOUR RIGHTS UNDER GDPR

As a data subject under GDPR, you have the following rights:

• Right of Access - you can request a copy of the personal data we hold about you.
• Right to Rectification - you can ask us to correct inaccurate or incomplete data.
• Right to Erasure - you can request that we delete your personal data. You can also delete your own account directly from within the app; see Settings > Delete Account.
• Right to Restriction of Processing - you can ask us to pause processing your data in certain circumstances.
• Right to Data Portability - you can request your data in a structured, machine-readable format.
• Right to Object - you can object to processing based on legitimate interest, or withdraw consent for marketing communications at any time.
• Rights related to Automated Decision-Making - we do not make any solely automated decisions that produce legal or significant effects about you.

To exercise any of these rights, email info@joyal.co. We will respond within 30 days. We may need to verify your identity before processing requests.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Data Protection Commission (Ireland)

9. CHILDREN'S DATA

Our platform is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us at info@joyal.co and we will delete it promptly.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this document. We encourage you to review this policy periodically. Continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

11. CONTACT US

For any privacy-related questions, data access requests, or complaints:

Email: info@joyal.co

Website: https://joyal.co

Joyal

Ireland